AWS SSM SSH Proxy Command

aws-ssm-ec2-proxy-command

Prerequisits

Local Setup
- Install AWS CLI
- Install AWS CLI Session Manager Plugin
Ensure Your IAM Permissions
- IAM Policy Example
- ssm:StartSession for DocumentName: AWS-StartSSHSession and Target Instance
  - AWS DOcumentation
- ssm:SendCommand for DocumentName: AWS-RunShellScript and Target Instance
  - AWS DOcumentation
Target Instance Setup
- Ensure SSM Permissions fo Target Instance Profile
- Ensure SSM Agent is installed (preinstalled on all AWS Linux AMIs already)
  - Install SSM Agent on Linux Instances
    - yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm & service amazon-ssm-agent restart
  - SSM Agent on Windows Instances

Install SSH Proxy Command

Move proxy command script aws-ssm-ec2-proxy-command.sh to ~/.ssh/aws-ssm-ec2-proxy-command.sh
Ensure it is executable (chmod +x ~/.ssh/aws-ssm-ec2-proxy-command.sh)

Setup SSH Config

Add ssh config entry for aws ec2 instances to your ~/.ssh/config. Adjust key file path if needed.

host i-* mi-*
  IdentityFile ~/.ssh/id_rsa
  ProxyCommand ~/.ssh/aws-ssm-ec2-proxy-command.sh %h %r %p ~/.ssh/id_rsa.pub
  StrictHostKeyChecking no

Open SSH Connection

ssh <INSTACEC_USER>@<INSTANCE_ID>
Ensure AWS CLI environemnt variables are set properly
- e.g. AWS_PROFILE='default' ssh [email protected]
- If default region does not match instance region you need to provide it like this
- AWS_PROFILE='default' ssh <INSTACEC_USER>@<INSTANCE_ID>--<INSTANCE_REGION>

TODO

Add variant to send ssh key by ec2-instance-connect:SendSSHPublicKey

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html

0 Open More issues

Closed

A 'not a tty' file generated from the proxy command

For some reasons, a new empty not a tty file is created under my current directory after I've run ssh i-XXXXXXX via this proxy script.

I'm not sure what is causing this, and it's not from the echo ... >/dev/tty line 🤔

bug

opened Jun 6, 2020 by zmingxie 10

Closed

ssh handshake expose on mac

Not really sure whether the words are correct. But I found that if there's no sh -c wrap the session create command, it will expose the handshake process and cause error like: protocol mismatch

I have to use

sh -c "aws ssm start-session \
  --target "${ec2_instance_id}" \
  --document-name 'AWS-StartSSHSession' \
  --parameters "portNumber=${ssh_port}""

instead of

aws ssm start-session \
  --target "${ec2_instance_id}" \
  --document-name 'AWS-StartSSHSession' \
  --parameters "portNumber=${ssh_port}"

opened Sep 16, 2020 by lisbethw1130 4

Closed

Gcchaves

Hey,

Got some problems with the script, "~/${ssh_user}" is creating /home/user/user, also the SSM agent undestands "~/" as "/var/snap/amazon-ssm-agent/".

opened Aug 7, 2020 by marinheiromc 3

Closed

Wrong ssh directory path

bug

opened Aug 7, 2020 by marinheiromc 3

Closed

Added a check for ensuring the .ssh directory exists.

When connecting to SSM the first time after instance creation, the connections fail because the .ssh directory does not yet exist for the ssm-user.

opened Jul 23, 2020 by opsroller 2

Closed

Consider applying a license

Hello, and thanks for this. Would you consider applying a license or a public domain dedication to this repository?

I ask because, as a user in an academic environment, my projects come (as a matter of routine) under scrutiny for copyright compliance and plagiarism. Having a license or dedication is very useful when this happens.

opened Oct 18, 2020 by kastork 2

v1.0.0(Oct 18, 2020)

Source code(tar.gz)
Source code(zip)

Information

Category: Linux / Miscellaneous
Watchers: 2
Star: 3
Fork: 0
Last update: Jun 10, 2020

Resource links

https://github.com/qoomon/aws-ssm-ec2-proxy-command

Share this repo

Related Repos

Miscellaneous

720

Install Linux from a running Windows system, without need for a live USB.

Install Linux over or alongside an existing Windows install, straight from Windows, without requiring to boot from external media like a flash drive or making BIOS configuration changes.